755 matches found
GHSA-PHC3-FGPG-7M6H Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS
Impact This is an uncontrolled resource consumption vulnerability CWE-400 that can lead to Denial of Service DoS. In vulnerable Undici versions, when interceptors.deduplicate is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An...
GHSA-XJ37-QJG2-XWV2 @whyour/qinglong: manipulation of the argument command leads to protection mechanism failure
A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure. The attack may be initiated remotely. The...
CVE-2026-3381 affecting package zlib for versions less than 1.3.2-1
CVE-2026-3381 affecting package zlib for versions less than 1.3.2-1. An upgraded version of the package is available that resolves this issue...
External Control of File Name or Path
Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...
CVE-2025-38695 affecting package kernel for versions less than 5.15.200.1-1
CVE-2025-38695 affecting package kernel for versions less than 5.15.200.1-1. An upgraded version of the package is available that resolves this issue...
CVE-2025-39681 affecting package kernel for versions less than 5.15.200.1-1
CVE-2025-39681 affecting package kernel for versions less than 5.15.200.1-1. An upgraded version of the package is available that resolves this issue...
CVE-2025-38639 affecting package kernel for versions less than 5.15.200.1-1
CVE-2025-38639 affecting package kernel for versions less than 5.15.200.1-1. An upgraded version of the package is available that resolves this issue...
PT-2026-23093
Name of the Vulnerable Software and Affected Versions jackson-core versions 3.0.0 through 3.0.x Description jackson-core contains core low-level incremental "streaming" parser and generator abstractions. The UTF8DataInputJsonParser and ReaderBasedJsonParser bypass the maxNestingDepth constraint...
Linux Distros Unpatched Vulnerability : CVE-2026-27204
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are...
CVE-2026-27204
CVE-2026-27204 involves Wasmtime’s WASI host interfaces, where guest code could exhaust host resources due to insufficient limits on resource allocations. Affected versions prior to fixes include 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0. The fixes are released in Wasmtime 24.0.6, 36.0.6, 40.0.4...
CVE-2026-27204 Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are susceptible to guest-controlled resource exhaustion on the host. Wasmtime did not appropriately place limits on resource allocations requested...
CVE-2025-71084 affecting package kernel for versions less than 6.6.121.1-1
CVE-2025-71084 affecting package kernel for versions less than 6.6.121.1-1. An upgraded version of the package is available that resolves this issue...
Security Bulletin: IBM Engineering Lifecycle Management - Jazz Foundation is impacted by vulnerabilities in Apache PDFBox
Summary Vulnerabilities have been identified in Apache PDFBox, which is used in IBM Engineering Lifecycle Management - Jazz Foundation. Vulnerability Details CVEID:CVE-2021-27807 DESCRIPTION: A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apac...
CVE-2023-25178
Controller may be loaded with malicious firmware which could enable remote code execution. See Honeywell Security Notification for recommendations on upgrading and versioning...
XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection
Impact Any user who can edit their own user profile or any other document can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The reason is that rendering output is included as...
CVE-2025-64506 affecting package libpng for versions less than 1.6.51-1
CVE-2025-64506 affecting package libpng for versions less than 1.6.51-1. An upgraded version of the package is available that resolves this issue...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via the enforcer that uses environment variables without sanitation. An attacker can execute arbitrary commands or cause a buffer overflow by supplying crafted input to the affected component. Remediation Upgrade...
Security Bulletin: IBM Sterling Connect:Direct Web Services vulnerable to spring-beans-6.2.3.jar (CVE-2025-41242)
Summary IBM Sterling Connect:Direct Web Services is vulnerable toPath Traversal Vulnerability in spring-beans-6.2.3. This has been addressed in new fixpacks available from Fix Central. Vulnerability Details CVEID:CVE-2025-41242 DESCRIPTION: Spring Framework MVC applications can be vulnerable to a...
